output {
  if [message] =~ ab {
    file {
      path => output.txt
      serializer => json_logstash
    }
  }
}